ROOTING TECHNOLOGIES PRIVACY POLICY

Rooting Technologies Application Privacy Policy.

Effective Date: 7/20/2026
Last Updated: 7/20/2026

Data Controller & Operator: Rooting Technologies Ltd

1. Introduction

Rooting Technologies Ltd ("Rooting Technologies", "we", "our", or "us") is a Ugandan construction technology company dedicated to protecting construction investments by reducing avoidable losses through professional oversight, structured processes, and smart technology. Our platform enables project stakeholders to monitor construction activities, improve project visibility, strengthen accountability, and make informed decisions whether on-site or remotely.

Rooting Technologies is committed to protecting the privacy and security of the information entrusted to us. This Privacy Policy explains how we collect, use, store, protect, and manage personal information when you use our mobile application, web services, and related platforms.

By using our services, you acknowledge that your information will be processed in accordance with this Privacy Policy.

2. Scope and Legal Framework

This Privacy Policy applies to all personal information collected, processed, stored, or managed through Rooting Technologies' mobile applications, web platforms, marketplace services, and associated supporting systems.

We process personal information in accordance with applicable data protection laws, including:

• The Data Protection and Privacy Act, 2019 (Uganda)

• The Data Protection and Privacy Regulations, 2021

• Other applicable legal and regulatory requirements governing personal data protection where our services are provided.

For purposes of applicable data protection legislation, Rooting Technologies Ltd acts as the Data Controller and Platform Operator, determining the purposes and means by which personal information is processed.

3. Information We Collect

Depending on how you use our platform and the services available to your account, we may collect the following categories of information.

A. Account and Profile Information

When creating or managing an account, we may collect:

• Full name

• Business email address

• Phone number

• Username or unique account identifier

• Assigned user role and access permissions

• Company or business registration information where applicable

This information enables us to identify users, manage access rights, authenticate accounts, and provide secure platform functionality.

B. Project and Operational Information

Construction Assurance Services

Where users utilize our Construction Assurance services, the platform may process project-related information including:

• Project details

• Construction milestones

• Progress updates

• Inspection reports

• Quality assurance reports

• Bill of Quantities (BOQs)

• Architectural plans

• Engineering drawings

• Project documentation

• Construction photographs

• Uploaded files and supporting evidence

• Project communication records

• Activity logs

• Project location information

This information supports project monitoring, reporting, quality verification, cost evaluation, and informed decision-making throughout the construction lifecycle.

Surplus Marketplace Services

Where users engage with the Surplus Marketplace, we may collect and process information including:

• Product and merchandise listings

• Purchase history

• Pricing proposals

• Marketplace bids

• Seller payout information

• Business location

• Merchant or vendor registration details

• Payment-related metadata necessary to complete transactions

Rooting Technologies does not collect or store complete credit or debit card information. Payment card transactions are processed through trusted PCI-DSS compliant third-party payment providers.

C. Technical and Device Information

To maintain the security, reliability, and performance of our platform, we may automatically collect limited technical information, including:

• Device type

• Operating system information

• Unique device identifiers

• Application version

• IP address

• Authentication logs

• Session identifiers

• Crash reports

• Performance diagnostics

• Security monitoring information

This information is used solely to support application functionality, maintain platform security, troubleshoot technical issues, and improve user experience.

4. How We Use Information

The information we collect is used only for legitimate business purposes necessary to operate and improve our services. These purposes include:

• Providing and maintaining application functionality.

• Authenticating users and managing accounts.

• Delivering role-based dashboards and system features.

• Supporting project planning, monitoring, reporting, and quality assurance.

• Processing marketplace transactions and facilitating communication between authorized parties.

• Tracking project costs, milestones, and progress.

• Protecting project documentation and other sensitive construction information.

• Responding to customer support requests.

• Improving platform reliability, performance, and security.

• Detecting, preventing, and investigating unauthorized access, fraud, or misuse.

• Complying with legal and regulatory obligations.

We process personal information only where there is a lawful basis to do so. Depending on the nature of the processing, these legal bases include:

Purpose

Legal Basis

User authentication, account management, and delivery of core application functionality

Contractual Necessity

Marketplace operations, transaction processing, and vendor management

Contractual Necessity

Project monitoring, cost evaluation, quality assurance, and operational reporting

Legitimate Interest

Platform security, fraud prevention, protection of construction documents, and compliance activities

Legitimate Interest and Legal Obligation

Customer support, operational communications, and important service notifications

Contractual Necessity

5. Data Sharing

Rooting Technologies respects the confidentiality of your information. We do not sell, rent, or trade your personal information or project data to third parties for marketing purposes.

We share information only where it is necessary to operate our services, fulfill contractual obligations, comply with legal requirements, or protect the security and integrity of our platform.

Information may be shared in the following circumstances:

• Authorized Users: Access to information within the platform is governed through Role-Based Access Control (RBAC). Users can only access information relevant to their assigned roles and permissions.

• Service Providers: We may share limited information with trusted third-party providers that support our platform, including cloud hosting, infrastructure management, cybersecurity services, authentication, payment processing, and application maintenance. These providers are contractually required to safeguard personal information and process it only on our instructions.

• Marketplace Transactions: Where users participate in the Surplus Marketplace, limited contact, business, and listing information may be shared between buyers, sellers, contractors, or other authorized participants solely to facilitate transactions and fulfil marketplace obligations.

• Legal and Regulatory Requirements: We may disclose information where required by applicable law, court order, regulatory authority, or lawful government request, including requests made by Uganda's Personal Data Protection Office (PDPO), law enforcement agencies, or other competent authorities.

We ensure that any sharing of personal information is limited to what is necessary for the specific purpose and is carried out in accordance with applicable data protection laws.

6. Data Security and Intellectual Property Protection

Rooting Technologies implements appropriate technical, organizational, and administrative safeguards designed to protect personal information, project data, and confidential construction documentation against unauthorized access, disclosure, alteration, or destruction.

Our security measures include:

• Encryption of data during transmission between user devices and our servers.

• Secure authentication mechanisms.

• Multi-factor authentication (MFA) for privileged administrative access where applicable.

• Role-Based Access Control (RBAC) to restrict access according to user responsibilities.

• Secure storage of project documents and sensitive information.

• Protection of Bills of Quantities (BOQs), architectural plans, engineering drawings, reports, and other proprietary project documentation.

• Continuous security monitoring, vulnerability assessments, system auditing, and threat detection.

• Regular maintenance and updates to strengthen platform security.

Where appropriate, sensitive project documents may also be protected through controlled viewing permissions, watermarking, or other measures designed to reduce unauthorized distribution.

While we employ commercially reasonable security measures to safeguard information, no method of electronic transmission or digital storage can be guaranteed to be completely secure. Users should also take reasonable steps to protect their account credentials and devices.

7. Application Permissions

The Rooting Technologies application requests only those permissions necessary to provide specific platform features and services.

Depending on the functionality used, the application may request access to:

• Camera – to capture and upload construction photographs, inspection evidence, and supporting project documentation.

• Storage or File Access – to upload, download, or access project documents, reports, engineering drawings, BOQs, and other authorized files.

• Approximate Location – to record project or inspection locations where location verification is required.

• Notifications – to deliver project updates, task alerts, security notifications, and other important operational communications.

Users may manage or withdraw these permissions at any time through their device settings. Please note that disabling certain permissions may limit the availability or functionality of specific features within the application.

8. User Accounts and Data Subject Rights

Users are responsible for maintaining the confidentiality of their account credentials and for ensuring that unauthorized persons do not gain access to their accounts.

Access to platform information is controlled according to assigned user roles and permissions.

Subject to applicable law, users have the right to:

• Request access to the personal information we hold about them.

• Request correction of inaccurate or incomplete information.

• Request deletion of personal information where legally permissible.

• Request restriction or objection to certain types of data processing.

• Withdraw consent where processing is based on consent, without affecting processing already carried out lawfully.

• Request clarification regarding how their personal information is processed.

Certain requests may be limited where retention of information is required by law, contractual obligations, regulatory requirements, or legitimate business purposes, including construction project record retention.

Requests relating to personal information may be submitted using the contact details provided at the end of this Privacy Policy.

9. Data Retention

Rooting Technologies retains personal information and project data only for as long as necessary to fulfil the purposes described in this Privacy Policy, including operational, contractual, legal, regulatory, and security requirements.

Retention periods vary depending on the nature of the information collected. For example:

Information Category

Typical Retention Period

Account Information

For the duration of the active account and any applicable legal retention period thereafter.

Project Documentation and Quality Assurance Records

In accordance with contractual obligations, applicable construction record retention requirements, legal obligations, and client agreements.

Marketplace and Transaction Records

As required for financial reporting, auditing, taxation, dispute resolution, and regulatory compliance.

Technical Logs and Security Records

For as long as reasonably necessary to maintain platform security, investigate incidents, and meet compliance requirements.

When information is no longer required, it is securely deleted, anonymized, or archived using appropriate security measures.

10. Account Deletion and Data Requests

Users may request deletion of their account or make requests relating to their personal information by contacting Rooting Technologies using the contact information provided in this Privacy Policy.

Upon receiving a request, we will verify the identity of the requester and process the request within a reasonable timeframe, subject to applicable legal, contractual, and regulatory obligations.

Please note that certain information may be retained where required to:

• Comply with legal or regulatory obligations.

• Resolve disputes or enforce agreements.

• Maintain financial or audit records.

• Protect the integrity and security of the platform.

• Preserve project records where required under applicable construction contracts or law.

Where complete deletion is not legally possible, retained information will remain protected in accordance with this Privacy Policy.

11. Third-Party Services and International Data Transfers

To deliver our services efficiently and securely, Rooting Technologies works with carefully selected third-party service providers that support the operation of our platform.

These services may include:

• Cloud hosting and infrastructure services

• User authentication and identity management

• Database management

• Security monitoring and platform maintenance

• Payment processing services

Examples of providers currently used by the platform include:

• Supabase – Database management, authentication, and backend infrastructure.

• PCI-DSS compliant payment providers and authorized Mobile Money aggregators – Secure processing of electronic payments.

These third-party providers process information only as necessary to perform services on our behalf and are contractually required to implement appropriate security and confidentiality measures.

Some service providers may process or store information on servers located outside Uganda. Where personal information is transferred internationally, Rooting Technologies implements appropriate safeguards, including contractual data protection obligations, encryption, and other appropriate security measures to protect personal information during cross-border transfers.

12. Contact Information

If you have any questions about this Privacy Policy, wish to exercise your privacy rights, or have concerns regarding how your personal information is handled, please contact us:

Rooting Technologies Ltd

Address:
Westside Building, Kigobe Road, Ntinda, Uganda

Email:
info@rootingtechnologies.com

Telephone:
+256 779 129 429
+256 770 477 738

Where applicable, you also have the right to lodge a complaint with Uganda's Personal Data Protection Office (PDPO) if you believe your rights under applicable data protection laws have been infringed.

Approved By:

Name: Aanyu Diannah

Date: July 21, 2026

Position: Managing Director